Suspicious External IP Lookup by Non-Browser Process

SigmaHQ Detections@sigmaHQ

•updated Feb 3, 2025•1•0•35

Detects network connections made by non-browser processes to public IP lookup services. This activity can indicate an adversary performing discovery to understand the external IP address of a compromised system, often as a post-compromise internet connectivity test or for reconnaissance purposes.